peter
19c1798f90
Replaces the single per-user DRF token with named, individually-revocable
API keys, so you can run one key per agent and cut off a leaked one without
disrupting the others.
- New ApiKey model (user, name, dbk_-prefixed key, created_at, last_used_at).
Data migration copies every existing authtoken 1:1 into a "default" named
key with the same value, so no client (incl. the sibling test project's
hardcoded test-user key) needs reconfiguring.
- Auth (resolve_token_user) resolves against ApiKey and stamps last_used_at,
throttled to one write/minute.
- Settings -> API Keys: table with name/key/created/last-used + per-row
revoke and a create form; keys viewable on demand. Settings -> Account now
links here; Settings -> Users issues a named initial key.
- Gated provisioning API for test installations: GET/POST /api/keys and
DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset ->
follows DEBUG, so off in deployment). Advertised via key_provisioning_api
in /api/capabilities; 403 when disabled.
- Docs (api/deployment/quickstart/posting-helper), SKILL.md, and env.example
updated from "token / Settings -> Account" to "key / Settings -> API Keys".
- Tests: new API + UI suites for keys; existing token-based tests moved to
ApiKey. Full suite 129 passing.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
32 lines
1.1 KiB
Python
32 lines
1.1 KiB
Python
from django.db import migrations
|
|
|
|
|
|
def copy_tokens_to_apikeys(apps, schema_editor):
|
|
"""Carry every existing DRF authtoken over to a named ApiKey so keys issued
|
|
before the multi-key feature keep authenticating (incl. the permanent test
|
|
user and any deployed agents). Same key string -> no client reconfiguration."""
|
|
Token = apps.get_model("authtoken", "Token")
|
|
ApiKey = apps.get_model("artifacts", "ApiKey")
|
|
for token in Token.objects.all():
|
|
if ApiKey.objects.filter(key=token.key).exists():
|
|
continue
|
|
api_key = ApiKey.objects.create(user_id=token.user_id, name="default", key=token.key)
|
|
# created_at is auto_now_add, so set it after the fact to preserve the
|
|
# original issue date (queryset.update bypasses auto_now_add).
|
|
ApiKey.objects.filter(pk=api_key.pk).update(created_at=token.created)
|
|
|
|
|
|
def noop(apps, schema_editor):
|
|
pass
|
|
|
|
|
|
class Migration(migrations.Migration):
|
|
|
|
dependencies = [
|
|
("artifacts", "0014_apikey"),
|
|
("authtoken", "0004_alter_tokenproxy_options"),
|
|
]
|
|
|
|
operations = [
|
|
migrations.RunPython(copy_tokens_to_apikeys, noop),
|
|
]
|